@openvtc/trust-tasks 0.27.3 → 0.27.5

package/src/_shared/components.ts

@@ -426,22 +426,41 @@ export type BlobRef = DigestMultibase;
 /**
  * One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.
  */
-export type BoardEntry =
-  | CastEntry
-  | ReplacementEntry
-  | LifecycleEntry
-  | ResultEntry
-  | EncryptedCastEntry
-  | TransportKeyEntry
-  | DealingEntry
-  | ConfirmationEntry
-  | JustificationEntry
-  | ElectionKeyEntry
-  | PartialDecryptionsEntry
-  | UnsealedEntry
-  | SpoiledEntry
-  | TrusteeStepEntry
-  | DecryptionAuthorizedEntry;
+export type BoardEntry_VotingV0_1 =
+  | CastEntry_VotingV0_1
+  | ReplacementEntry_VotingV0_1
+  | LifecycleEntry_VotingV0_1
+  | ResultEntry_VotingV0_1
+  | EncryptedCastEntry_VotingV0_1
+  | TransportKeyEntry_VotingV0_1
+  | DealingEntry_VotingV0_1
+  | ConfirmationEntry_VotingV0_1
+  | JustificationEntry_VotingV0_1
+  | ElectionKeyEntry_VotingV0_1
+  | PartialDecryptionsEntry_VotingV0_1
+  | UnsealedEntry_VotingV0_1
+  | SpoiledEntry_VotingV0_1
+  | TrusteeStepEntry_VotingV0_1
+  | DecryptionAuthorizedEntry_VotingV0_1;
+/**
+ * One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.
+ */
+export type BoardEntry_VotingV0_2 =
+  | CastEntry_VotingV0_2
+  | ReplacementEntry_VotingV0_2
+  | LifecycleEntry_VotingV0_2
+  | ResultEntry_VotingV0_2
+  | EncryptedCastEntry_VotingV0_2
+  | TransportKeyEntry_VotingV0_2
+  | DealingEntry_VotingV0_2
+  | ConfirmationEntry_VotingV0_2
+  | JustificationEntry_VotingV0_2
+  | ElectionKeyEntry_VotingV0_2
+  | PartialDecryptionsEntry_VotingV0_2
+  | UnsealedEntry_VotingV0_2
+  | SpoiledEntry_VotingV0_2
+  | TrusteeStepEntry_VotingV0_2
+  | DecryptionAuthorizedEntry_VotingV0_2;
 /**
  * `public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).
  */
@@ -866,11 +885,19 @@ export type FileData = string;
 /**
  * The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.
  */
-export type ForgeHost = string;
+export type ForgeHost_GitNsV0_1 = string;
+/**
+ * The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, `gitlab.com`, or a self-hosted Forgejo or GitLab instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.
+ */
+export type ForgeHost_GitNsV0_6 = string;
 /**
  * An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`"812736451"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.
  */
-export type ForgeId = string;
+export type ForgeId_GitNsV0_1 = string;
+/**
+ * An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub, Forgejo and GitLab ids are decimal integers written as strings (`"812736451"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.
+ */
+export type ForgeId_GitNsV0_6 = string;
 /**
  * Validity of a grant the sweep issues, in seconds: between one day and two years, the bounds vtc/vetting/vetters/grant applies to an administrator's grants.
  */
@@ -1515,7 +1542,11 @@ export type ReleaseRequirement = "consent" | "stepUp";
 /**
  * A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.
  */
-export type RepoResource = string;
+export type RepoResource_GitNsV0_1 = string;
+/**
+ * A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo-path>`, lowercase, where the repository path has 1 to 21 segments (see `Resource`).
+ */
+export type RepoResource_GitNsV0_6 = string;
 /**
  * Repository visibility on the forge.
  */
@@ -1530,14 +1561,18 @@ export type RequestId = string;
  * @maxItems 32
  */
 export type RequestedAttributes = RequestedAttribute[];
+/**
+ * Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.
+ */
+export type ResourceQualifier = string;
 /**
  * A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.
  */
-export type Resource = string;
+export type Resource_GitNsV0_1 = string;
 /**
- * Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.
+ * A forge-qualified resource, all lowercase: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo-path>` for one repository — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. On a forge with nested groups (GitLab) the repository path holds the subgroups between the top-level owner and the project: `gitlab.com/acme/platform/tools/cli` is one repository of the namespace `gitlab.com/acme`, and a subgroup such as `gitlab.com/acme/platform` is not a resource. A repository path has 1 to 21 segments (GitLab: 20 levels of subgroup and the project); GitHub and Forgejo repository paths are always one. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.
  */
-export type ResourceQualifier = string;
+export type Resource_GitNsV0_6 = string;
 /**
  * Opaque, community-minted position in one caller's event stream. A console MUST NOT parse, construct or order it; it only hands the latest one back as `since` when it re-subscribes. A community binds it to the caller it was minted for and treats a token minted for anyone else as unknown.
  */
@@ -1751,7 +1786,11 @@ export type SecretKind_VaultV0_2 =
 /**
  * One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.
  */
-export type Segment = string;
+export type Segment_GitNsV0_1 = string;
+/**
+ * One lowercased owner, group or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`. Up to 255 characters, the longest name GitLab allows; GitHub and Forgejo names are shorter.
+ */
+export type Segment_GitNsV0_6 = string;
 /**
  * How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.
  *
@@ -2276,50 +2315,6 @@ export interface AcceptsCriterion_VtcV0_2 {
    */
   createdByDid: string;
 }
-/**
- * The mediator's view of one served account.
- */
-export interface Account {
-  /**
-   * The account's controlling DID, or — for privacy, and for mediators that key accounts by a one-way hash and never hold the full DID — a stable hash of that DID (see `Vid`). Whichever form is used, it is the opaque account identifier the other `account/*`, `acl/*`, and `access-list/*` tasks accept.
-   */
-  did: Vid;
-  accountType: AccountType;
-  acl: MediatorAcl;
-  queueLimits?: QueueLimits;
-  /**
-   * Current count of queued send messages.
-   */
-  sendQueueCount?: number;
-  /**
-   * Current byte size of queued send messages.
-   */
-  sendQueueBytes?: number;
-  /**
-   * Current count of queued receive messages.
-   */
-  receiveQueueCount?: number;
-  /**
-   * Current byte size of queued receive messages.
-   */
-  receiveQueueBytes?: number;
-  /**
-   * Number of entries in the account's access list.
-   */
-  accessListCount?: number;
-  /**
-   * Unix epoch seconds at which the mediator last accepted a message addressed to this account. Present only when the request set `includeActivity` and the mediator has recorded such a message; MAY lag the true time by up to 60 seconds.
-   */
-  lastReceivedAt?: number;
-  /**
-   * Unix epoch seconds at which this account last completed authentication with the mediator, over any transport. Present only when the request set `includeActivity` and the mediator has recorded an authentication.
-   */
-  lastAuthenticatedAt?: number;
-  /**
-   * Lifetime counters the mediator keeps for this account. Present only when the request set `includeStats`.
-   */
-  stats?: AccountStats;
-}
 /**
  * Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.
  */
@@ -2398,7 +2393,7 @@ export interface AccountBinding {
       ];
   grantedAt?: string;
 }
-export interface AccountProbeReport {
+export interface AccountProbeReport_ExternalV0_1 {
   at: string;
   /**
    * True when every step that ran succeeded.
@@ -2792,183 +2787,577 @@ export interface AccountProbeReport {
         }
       ];
 }
-/**
- * The public half of the account's key, as the provider needs it. Never a private key.
- */
-export interface AccountPublicMaterial {
-  algorithm: "ES256" | "RS256" | "Secp256r1";
-  /**
-   * Digest of the public key's SubjectPublicKeyInfo DER.
-   */
-  keyFingerprint: DigestMultibase;
-  /**
-   * The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.
-   */
-  publicKeyJwk?: {
-    kty: "EC" | "RSA";
-    crv?: "P-256";
-    x?: string;
-    y?: string;
-    n?: string;
-    e?: string;
-    kid: string;
-    alg?: "ES256" | "RS256";
-    use?: "sig";
-  };
-  /**
-   * `aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
-   */
-  certificatePem?: string;
+export interface AccountProbeReport_ExternalV0_2 {
+  probedAt: string;
   /**
-   * `sui-signer`: the Sui address the key controls.
+   * True when every step that ran succeeded.
    */
-  address?: string;
+  ok: boolean;
   /**
-   * During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.
+   * True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.
    */
-  pendingKeyFingerprint?: DigestMultibase;
-}
-/**
- * That a static model's secret is set, and which one. Never its value.
- */
-export interface AccountSecretInfo {
-  fingerprint: SecretFingerprint;
-  setAt: string;
-}
-/**
- * What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.
- */
-export interface AccountSetupArtifacts {
-  model: AuthModel;
+  complete: boolean;
   /**
-   * @maxItems 16
+   * In order; the first failing step ends the probe.
+   *
+   * @maxItems 8
    */
-  artifacts:
+  steps:
     | []
     | [
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         }
       ]
     | [
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         }
       ]
     | [
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         }
       ]
     | [
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         }
       ]
     | [
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
           /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
            */
-          name: string;
-          mediaType: string;
-          content: string;
+          providerError?: string;
+          providerRequestId?: string;
         },
         {
-          /**
-           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        }
+      ]
+    | [
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        }
+      ]
+    | [
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        }
+      ]
+    | [
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        },
+        {
+          step: AccountProbeStep;
+          ok: boolean;
+          durationMs?: number;
+          /**
+           * The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
+           */
+          providerError?: string;
+          providerRequestId?: string;
+        }
+      ];
+}
+/**
+ * The public half of the account's key, as the provider needs it. Never a private key.
+ */
+export interface AccountPublicMaterial {
+  algorithm: "ES256" | "RS256" | "Secp256r1";
+  /**
+   * Digest of the public key's SubjectPublicKeyInfo DER.
+   */
+  keyFingerprint: DigestMultibase;
+  /**
+   * The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.
+   */
+  publicKeyJwk?: {
+    kty: "EC" | "RSA";
+    crv?: "P-256";
+    x?: string;
+    y?: string;
+    n?: string;
+    e?: string;
+    kid: string;
+    alg?: "ES256" | "RS256";
+    use?: "sig";
+  };
+  /**
+   * `aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
+   */
+  certificatePem?: string;
+  /**
+   * `sui-signer`: the Sui address the key controls.
+   */
+  address?: string;
+  /**
+   * During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.
+   */
+  pendingKeyFingerprint?: DigestMultibase;
+}
+/**
+ * That a static model's secret is set, and which one. Never its value.
+ */
+export interface AccountSecretInfo {
+  fingerprint: SecretFingerprint;
+  setAt: string;
+}
+/**
+ * What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.
+ */
+export interface AccountSetupArtifacts {
+  model: AuthModel;
+  /**
+   * @maxItems 16
+   */
+  artifacts:
+    | []
+    | [
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        }
+      ]
+    | [
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        }
+      ]
+    | [
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        }
+      ]
+    | [
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        }
+      ]
+    | [
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
+           */
+          name: string;
+          mediaType: string;
+          content: string;
+        },
+        {
+          /**
+           * File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
            */
           name: string;
           mediaType: string;
@@ -3989,21 +4378,109 @@ export interface AccountStats {
    */
   messagesSent?: number;
   /**
-   * Total size of the messages counted by messagesReceived.
+   * Total size of the messages counted by messagesReceived.
+   */
+  bytesReceived?: number;
+  /**
+   * Total size of the messages counted by messagesSent.
+   */
+  bytesSent?: number;
+  /**
+   * messagesReceived split by the wire protocol the message arrived in.
+   */
+  receivedByProtocol?: ProtocolCounts;
+  /**
+   * messagesSent split by the wire protocol the message was sent in.
+   */
+  sentByProtocol?: ProtocolCounts;
+}
+/**
+ * The mediator's view of one served account.
+ */
+export interface Account_MessagingV0_1 {
+  /**
+   * The account's controlling DID, or — for privacy, and for mediators that key accounts by a one-way hash and never hold the full DID — a stable hash of that DID (see `Vid`). Whichever form is used, it is the opaque account identifier the other `account/*`, `acl/*`, and `access-list/*` tasks accept.
+   */
+  did: Vid;
+  accountType: AccountType;
+  acl: MediatorAcl;
+  queueLimits?: QueueLimits;
+  /**
+   * Current count of queued send messages.
+   */
+  sendQueueCount?: number;
+  /**
+   * Current byte size of queued send messages.
+   */
+  sendQueueBytes?: number;
+  /**
+   * Current count of queued receive messages.
+   */
+  receiveQueueCount?: number;
+  /**
+   * Current byte size of queued receive messages.
+   */
+  receiveQueueBytes?: number;
+  /**
+   * Number of entries in the account's access list.
+   */
+  accessListCount?: number;
+  /**
+   * Unix epoch seconds at which the mediator last accepted a message addressed to this account. Present only when the request set `includeActivity` and the mediator has recorded such a message; MAY lag the true time by up to 60 seconds.
+   */
+  lastReceivedAt?: number;
+  /**
+   * Unix epoch seconds at which this account last completed authentication with the mediator, over any transport. Present only when the request set `includeActivity` and the mediator has recorded an authentication.
+   */
+  lastAuthenticatedAt?: number;
+  /**
+   * Lifetime counters the mediator keeps for this account. Present only when the request set `includeStats`.
+   */
+  stats?: AccountStats;
+}
+/**
+ * The mediator's view of one served account.
+ */
+export interface Account_MessagingV0_2 {
+  /**
+   * The account's controlling DID, or — for privacy, and for mediators that key accounts by a one-way hash and never hold the full DID — a stable hash of that DID (see `Vid`). Whichever form is used, it is the opaque account identifier the other `account/*`, `acl/*`, and `access-list/*` tasks accept.
+   */
+  did: Vid;
+  accountType: AccountType;
+  acl: MediatorAcl;
+  queueLimits?: QueueLimits;
+  /**
+   * Current count of queued send messages.
+   */
+  sendQueueCount?: number;
+  /**
+   * Current byte size of queued send messages.
+   */
+  sendQueueBytes?: number;
+  /**
+   * Current count of queued receive messages.
+   */
+  receiveQueueCount?: number;
+  /**
+   * Current byte size of queued receive messages.
+   */
+  receiveQueueBytes?: number;
+  /**
+   * Number of entries in the account's access list.
    */
-  bytesReceived?: number;
+  accessListCount?: number;
   /**
-   * Total size of the messages counted by messagesSent.
+   * The instant at which the mediator last accepted a message addressed to this account. Present only when the request set `includeActivity` and the mediator has recorded such a message; MAY lag the true time by up to 60 seconds.
    */
-  bytesSent?: number;
+  lastReceivedAt?: string;
   /**
-   * messagesReceived split by the wire protocol the message arrived in.
+   * The instant at which this account last completed authentication with the mediator, over any transport. Present only when the request set `includeActivity` and the mediator has recorded an authentication.
    */
-  receivedByProtocol?: ProtocolCounts;
+  lastAuthenticatedAt?: string;
   /**
-   * messagesSent split by the wire protocol the message was sent in.
+   * Lifetime counters the mediator keeps for this account. Present only when the request set `includeStats`.
    */
-  sentByProtocol?: ProtocolCounts;
+  stats?: AccountStats;
 }
 export interface AclChangedEvent_SyncV0_1 {
   kind: "acl.changed";
@@ -4362,6 +4839,107 @@ export interface Action_VtcAdminActionsV0_2 {
   requesterOpenActions?: number;
   ext?: Ext;
 }
+/**
+ * One parked administrative operation, as the caller is entitled to see it. The same action reads differently to different callers only in `challenge` and `callerRole`, which are per-caller.
+ */
+export interface Action_VtcAdminActionsV0_3 {
+  actionId: ActionId;
+  /**
+   * `approval` — eligible approvers approve or decline, N-of-M; the operation executes when the threshold is met. `acknowledge` — an operation that already happened (an operator's offline or break-glass write) which every remaining administrator must acknowledge; there is nothing to approve or decline. `queue` — an existing human decision (for example a join review) surfaced in the same list, with a threshold of one. `coolingOff` — an operation with no eligible third party to consent, which lands by itself at `landsAt` unless its requester cancels it first; nobody approves, declines or acknowledges it.
+   */
+  category: "approval" | "acknowledge" | "queue" | "coolingOff";
+  /**
+   * The community's name for what kind of operation is parked, dotted and lowerCamelCase (`acl.grant.authority`, `member.join.review`). Selects the summary template. The set is OPEN: a renderer that does not recognise a kind still renders `summary` from its fields.
+   */
+  kind: string;
+  /**
+   * The Type URI of the parked operation — the Trust Task the community will execute when the action completes (for `coolingOff`, when it lands). Together with `payload` it is exactly what will run. For `acknowledge`, the Type URI of the operation that already took effect; an operator's offline write, which is a command on the community's host and has no Trust Task of its own, is named by the record type `https://trusttasks.org/spec/vtc/operator/offline-write/0.1`, and `payload` is then that record.
+   */
+  typeUri: string;
+  /**
+   * VID of the party whose operation was parked. For `acknowledge`, the operator whose offline write is being acknowledged, where the community can attribute one. For `coolingOff`, the administrator whose operation will land — the only party who may cancel it.
+   */
+  requester: string;
+  /**
+   * `open` — awaiting decisions, or for `coolingOff` awaiting `landsAt`. `completed` — the threshold was met and the operation executed, a `coolingOff` operation landed, or, for `acknowledge`, every administrator acknowledged. `declined` — an eligible approver denied it. `expired` — it lapsed at `expiresAt`. `cancelled` — the requester withdrew it, or the community invalidated it (see `closedReason`). `failed` — the threshold was met or `landsAt` reached but the re-check at execution refused it, or execution itself failed; the operation did not take effect.
+   */
+  status: "open" | "completed" | "declined" | "expired" | "cancelled" | "failed";
+  /**
+   * When the operation was parked.
+   */
+  createdAt: string;
+  /**
+   * When an open action lapses. ALWAYS present for `approval`, whose open life is bounded (72 hours by default; the community configures it between 15 minutes and 14 days). Absent for an `acknowledge` or `queue` action that does not expire, and ALWAYS absent for `coolingOff`, which does not lapse but lands — see `landsAt`.
+   */
+  expiresAt?: string;
+  /**
+   * When a `coolingOff` action lands: the instant from which the community executes the parked operation, after its execution-time re-check, unless the requester cancelled first. Present exactly when `category` is `coolingOff`. It is a deadline for the requester's cancellation, not for anyone's approval, and it is fixed when the action is parked: neither the requester nor the subject can move it.
+   */
+  landsAt?: string;
+  /**
+   * Who may withdraw the action with `vtc/admin/actions/cancel` while it is `open`. Present on every open `coolingOff` action, where it is `requester`: the operation lands unless its requester stops it, and nobody else — the subject included — can. A closed set so that a console can offer a cancel control without inferring it; future values would widen who may cancel and need a new version.
+   */
+  cancellableBy?: "requester";
+  /**
+   * When the action left `open`. Present exactly when `status` is not `open`.
+   */
+  closedAt?: string;
+  /**
+   * Why the action closed. Present exactly when `status` is not `open`. `invalidated` — the community closed it because something it depended on stopped holding before the threshold or `landsAt` (an approver or the requester lost standing, the target state moved); `failedRecheck` — the threshold was met or `landsAt` reached but the execution-time re-check refused; `landedAfterCoolingOff` — a `coolingOff` action reached `landsAt` uncancelled and its operation executed (`status: completed`).
+   */
+  closedReason?:
+    | "thresholdMet"
+    | "declined"
+    | "expired"
+    | "cancelledByRequester"
+    | "invalidated"
+    | "failedRecheck"
+    | "acknowledged"
+    | "landedAfterCoolingOff";
+  /**
+   * The number of distinct approvals the operation needs. Present for `approval`; absent otherwise (a `queue` decision is one decision by construction, `acknowledge` needs every remaining administrator, and `coolingOff` needs no approval at all).
+   */
+  threshold?: number;
+  /**
+   * The decisions in favour recorded so far — approvals for `approval` and `queue`, acknowledgements for `acknowledge` — one entry per distinct subject, in the order recorded. Empty while none has landed, and always empty for `coolingOff`, which takes no decisions.
+   */
+  approvals: {
+    /**
+     * VID of the approver or acknowledger, as proven by the decision's own proof.
+     */
+    subject: string;
+    /**
+     * When the decision was recorded.
+     */
+    decidedAt: string;
+  }[];
+  /**
+   * How many further distinct decisions the action needs while `open` — approvals for `approval`, acknowledgements for `acknowledge`. Lets a console say 'one more' without disclosing the eligible set. Absent for `coolingOff`, which waits on time, not on decisions.
+   */
+  approversRemaining?: number;
+  summary: Summary;
+  /**
+   * The exact payload of the parked operation — the object `payloadDigest` is computed over and the one the community will execute. Carried so an approver can recompute the digest and re-derive every summary field from it rather than trusting the rendering (VTI-APV-013). Deliberately an open object: its shape is governed by the specification `typeUri` names, and a digest is checked over members exactly as received.
+   */
+  payload: {};
+  /**
+   * Digest of `payload`, taken over its RFC 8785 (JCS) canonicalization. The community re-derives it from the payload it is about to execute and refuses on mismatch. The digest an approver signs over is the challenge-salted one of `task-consent/decision`, not this value; this one lets the approver check that `payload` is what was parked.
+   */
+  payloadDigest: DigestMultibase;
+  /**
+   * Present ONLY on an action the CALLER may decide now — an `approval` or `queue` action on which the caller is an eligible approver who has not yet decided. Never present on `acknowledge` or `coolingOff`. Per-approver: two approvers are shown different challenges for the same action. Echoed verbatim in `task-consent/decision`'s `challenge`, which binds that decision to this approver and this action. Absent for everyone else, including the requester.
+   */
+  challenge?: string;
+  /**
+   * The caller's relation to this action. `approver` — an eligible approver (whether or not already decided). `requester` — the party whose operation was parked. `acknowledger` — an administrator expected to acknowledge it. `subject` — the party a `coolingOff` operation acts on, shown it so that they learn of it before it lands; a subject can neither decide nor cancel it. `observer` — none of these; seen only through the audit-read capability on a `history` or `all` view.
+   */
+  callerRole: "approver" | "requester" | "acknowledger" | "subject" | "observer";
+  /**
+   * How many open actions the requester currently has at the community, this one included. For consent-fatigue display: an approver shown the twentieth request from one requester today should be able to see that it is the twentieth.
+   */
+  requesterOpenActions?: number;
+  ext?: Ext;
+}
 /**
  * A privileged account at the mediator (an `admin` or `rootAdmin`).
  */
@@ -4403,13 +4981,53 @@ export interface AdminNote {
 /**
  * One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.
  */
-export interface AdminRightRow {
+export interface AdminRightRow_GitNsV0_5 {
+  /**
+   * Who holds the right.
+   */
+  subject: Did_GitNsV0_3;
+  right: Right;
+  resource: Resource_GitNsV0_1;
+  origin: RightOrigin;
+  /**
+   * Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.
+   */
+  grantedBy?: Did_GitNsV0_3;
+  /**
+   * Present exactly when `origin` is `recorded`.
+   */
+  grantedAt?: string;
+  /**
+   * When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).
+   */
+  expiresAt?: string;
+  /**
+   * The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.
+   */
+  reason?: string;
+  /**
+   * Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.
+   */
+  subjectMember: boolean;
+  /**
+   * Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).
+   */
+  granterDeparted: boolean;
+  /**
+   * Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.
+   */
+  breakGlass?: BreakGlass_GitNsV0_4;
+}
+/**
+ * One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.
+ */
+export interface AdminRightRow_GitNsV0_6 {
   /**
    * Who holds the right.
    */
   subject: Did_GitNsV0_3;
   right: Right;
-  resource: Resource;
+  resource: Resource_GitNsV0_6;
   origin: RightOrigin;
   /**
    * Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.
@@ -4438,7 +5056,7 @@ export interface AdminRightRow {
   /**
    * Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.
    */
-  breakGlass?: BreakGlass;
+  breakGlass?: BreakGlass_GitNsV0_6;
 }
 /**
  * A membership admitted directly, with the credentials issued for it — the success payload of vtc/members/admit and vtc/members/make-membership.
@@ -4482,7 +5100,7 @@ export interface AdmittedMembership {
 /**
  * An agent name bound to a DID. A name is only ever authoritative in the DID→name direction: the DID document's `alsoKnownAs` is what proves the binding, because anyone controlling a domain can point a name at somebody else's DID.
  */
-export interface AgentNameEntry {
+export interface AgentNameEntry_VtaV0_1 {
   /**
    * The name, without the host — the full form is `<host>/@<name>`.
    */
@@ -4497,6 +5115,24 @@ export interface AgentNameEntry {
   createdAt?: number;
   ext?: Ext;
 }
+/**
+ * An agent name bound to a DID. A name is only ever authoritative in the DID→name direction: the DID document's `alsoKnownAs` is what proves the binding, because anyone controlling a domain can point a name at somebody else's DID.
+ */
+export interface AgentNameEntry_VtaV0_7 {
+  /**
+   * The name, without the host — the full form is `<host>/@<name>`.
+   */
+  name: string;
+  /**
+   * Whether the name currently resolves. A disabled name is still held — it is not available for anyone else to take.
+   */
+  enabled: boolean;
+  /**
+   * When the entry was created (RFC 3339).
+   */
+  createdAt?: string;
+  ext?: Ext;
+}
 /**
  * The answer to one question. Exactly one member besides `question` is present, matching the question's type, or `abstain` for an optional question left unanswered.
  */
@@ -5011,81 +5647,179 @@ export interface BackupEnvelope {
   /**
    * base64url(AEAD(JSON(payload))).
    */
-  ciphertext: string;
+  ciphertext: string;
+}
+/**
+ * An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.
+ */
+export interface Ballot {
+  electionId: ElectionId;
+  manifestDigest: DigestMultibase;
+  /**
+   * @minItems 1
+   * @maxItems 128
+   */
+  answers: [Answer, ...Answer[]];
+}
+/**
+ * The ciphertext manifest of one blob, committed by the uploader before any byte moves. Its digest is the BlobRef. Every chunk is checked against `chunks.chunkDigests` on arrival and the reassembled blob against `digest`, so a host can neither accept nor serve bytes the uploader did not commit to. The manifest also appears, by its BlobRef, inside the sealed FileManifest the author signs; a reader who opens the record therefore knows which ciphertext its author meant, and a host cannot substitute a different blob under the same record.
+ *
+ * Consistency rules JSON Schema cannot state: `chunks.chunkCount` MUST equal ceil(size / chunks.chunkSize), and `chunks.chunkDigests` MUST have exactly `chunkCount` items. A party receiving a manifest violating either MUST refuse it.
+ *
+ * Each transfer chunk is exactly one sealed STREAM segment (see FileManifest): every chunk but the last is `chunkSize` bytes, and `chunkSize` is the plaintext segment size plus the 16-byte AEAD tag. The 262144-byte ceiling of ChunkSize therefore puts the largest plaintext segment at 262128 bytes, and the 4096-chunk ceiling of ChunkCount puts the largest blob at 1 GiB of ciphertext.
+ */
+export interface BlobManifest {
+  /**
+   * Ciphertext bytes, padding included. What the host stores, and what every limit and usage figure is stated in.
+   */
+  size: ExpectedSizeBytes;
+  chunks: ChunkManifest;
+  /**
+   * Digest of the whole ciphertext, over its bytes. Checked after reassembly, so a correct set of chunks in the wrong order is still caught.
+   */
+  digest: DigestMultibase;
+}
+export interface CastEntry_VotingV0_1 {
+  kind: "cast";
+  cast: Cast;
+}
+/**
+ * The cast at `replaces` is no longer counted: a later cast under the same tag is.
+ */
+export interface ReplacementEntry_VotingV0_1 {
+  kind: "replaced";
+  tag: Multibase_VotingV0_1;
+  replaces: number;
+  by: number;
+}
+export interface LifecycleEntry_VotingV0_1 {
+  kind: "opened" | "closed" | "closedEarly" | "cancelled";
+  at: string;
+}
+export interface ResultEntry_VotingV0_1 {
+  kind: "result";
+  result: ElectionResult;
+}
+export interface EncryptedCastEntry_VotingV0_1 {
+  kind: "encryptedCast";
+  cast: EncryptedCast;
+}
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
+export interface TransportKeyEntry_VotingV0_1 {
+  kind: "transportKey";
+  transportKey: TransportKey;
+}
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
+export interface DealingEntry_VotingV0_1 {
+  kind: "dealing";
+  dealing: Dealing;
+}
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
+export interface ConfirmationEntry_VotingV0_1 {
+  kind: "confirmation";
+  trustee: TrusteeIndex;
+  /**
+   * @maxItems 64
+   */
+  complaints: TrusteeIndex[];
+}
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
+export interface JustificationEntry_VotingV0_1 {
+  kind: "justification";
+  dealer: TrusteeIndex;
+  recipient: TrusteeIndex;
+  share: GroupScalar;
+}
+export interface ElectionKeyEntry_VotingV0_1 {
+  kind: "electionKey";
+  electionKey: ElectionKey;
+}
+export interface PartialDecryptionsEntry_VotingV0_1 {
+  kind: "partials";
+  trustee: TrusteeIndex;
+  /**
+   * @minItems 1
+   * @maxItems 100000
+   */
+  partials: [PartialDecryption, ...PartialDecryption[]];
+}
+export interface UnsealedEntry_VotingV0_1 {
+  kind: "unsealed";
+  leafIndex: number;
+  ballot: Ballot;
 }
 /**
- * An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.
+ * A sealed cast that did not open, or opened to no valid ballot: not counted (CONVENTIONS §9.7).
  */
-export interface Ballot {
-  electionId: ElectionId;
-  manifestDigest: DigestMultibase;
-  /**
-   * @minItems 1
-   * @maxItems 128
-   */
-  answers: [Answer, ...Answer[]];
+export interface SpoiledEntry_VotingV0_1 {
+  kind: "spoiled";
+  leafIndex: number;
 }
 /**
- * The ciphertext manifest of one blob, committed by the uploader before any byte moves. Its digest is the BlobRef. Every chunk is checked against `chunks.chunkDigests` on arrival and the reassembled blob against `digest`, so a host can neither accept nor serve bytes the uploader did not commit to. The manifest also appears, by its BlobRef, inside the sealed FileManifest the author signs; a reader who opens the record therefore knows which ciphertext its author meant, and a host cannot substitute a different blob under the same record.
- *
- * Consistency rules JSON Schema cannot state: `chunks.chunkCount` MUST equal ceil(size / chunks.chunkSize), and `chunks.chunkDigests` MUST have exactly `chunkCount` items. A party receiving a manifest violating either MUST refuse it.
- *
- * Each transfer chunk is exactly one sealed STREAM segment (see FileManifest): every chunk but the last is `chunkSize` bytes, and `chunkSize` is the plaintext segment size plus the 16-byte AEAD tag. The 262144-byte ceiling of ChunkSize therefore puts the largest plaintext segment at 262128 bytes, and the 4096-chunk ceiling of ChunkCount puts the largest blob at 1 GiB of ciphertext.
+ * One step of the trustees' ceremony — an enrolment, a dealing, a confirmation or a justification — as the trustee's own signed request, so that anyone reading the board can tell who took it (CONVENTIONS §9.6).
  */
-export interface BlobManifest {
-  /**
-   * Ciphertext bytes, padding included. What the host stores, and what every limit and usage figure is stated in.
-   */
-  size: ExpectedSizeBytes;
-  chunks: ChunkManifest;
-  /**
-   * Digest of the whole ciphertext, over its bytes. Checked after reassembly, so a correct set of chunks in the wrong order is still caught.
-   */
-  digest: DigestMultibase;
+export interface TrusteeStepEntry_VotingV0_1 {
+  kind: "trusteeStep";
+  request: SignedRequest;
+}
+/**
+ * The community's voting/trustees/authorize request, exactly as the ballot box received it: the decryption targets of a closed election, pinned by digest to a head of the board (CONVENTIONS §9.7).
+ */
+export interface DecryptionAuthorizedEntry_VotingV0_1 {
+  kind: "decryptionAuthorized";
+  request: SignedRequest;
 }
-export interface CastEntry {
+export interface CastEntry_VotingV0_2 {
   kind: "cast";
   cast: Cast;
 }
 /**
  * The cast at `replaces` is no longer counted: a later cast under the same tag is.
  */
-export interface ReplacementEntry {
+export interface ReplacementEntry_VotingV0_2 {
   kind: "replaced";
   tag: Multibase_VotingV0_1;
   replaces: number;
   by: number;
 }
-export interface LifecycleEntry {
+export interface LifecycleEntry_VotingV0_2 {
   kind: "opened" | "closed" | "closedEarly" | "cancelled";
-  at: string;
+  occurredAt: string;
 }
-export interface ResultEntry {
+export interface ResultEntry_VotingV0_2 {
   kind: "result";
   result: ElectionResult;
 }
-export interface EncryptedCastEntry {
+export interface EncryptedCastEntry_VotingV0_2 {
   kind: "encryptedCast";
   cast: EncryptedCast;
 }
 /**
  * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
  */
-export interface TransportKeyEntry {
+export interface TransportKeyEntry_VotingV0_2 {
   kind: "transportKey";
   transportKey: TransportKey;
 }
 /**
  * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
  */
-export interface DealingEntry {
+export interface DealingEntry_VotingV0_2 {
   kind: "dealing";
   dealing: Dealing;
 }
 /**
  * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
  */
-export interface ConfirmationEntry {
+export interface ConfirmationEntry_VotingV0_2 {
   kind: "confirmation";
   trustee: TrusteeIndex;
   /**
@@ -5096,17 +5830,17 @@ export interface ConfirmationEntry {
 /**
  * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
  */
-export interface JustificationEntry {
+export interface JustificationEntry_VotingV0_2 {
   kind: "justification";
   dealer: TrusteeIndex;
   recipient: TrusteeIndex;
   share: GroupScalar;
 }
-export interface ElectionKeyEntry {
+export interface ElectionKeyEntry_VotingV0_2 {
   kind: "electionKey";
   electionKey: ElectionKey;
 }
-export interface PartialDecryptionsEntry {
+export interface PartialDecryptionsEntry_VotingV0_2 {
   kind: "partials";
   trustee: TrusteeIndex;
   /**
@@ -5115,7 +5849,7 @@ export interface PartialDecryptionsEntry {
    */
   partials: [PartialDecryption, ...PartialDecryption[]];
 }
-export interface UnsealedEntry {
+export interface UnsealedEntry_VotingV0_2 {
   kind: "unsealed";
   leafIndex: number;
   ballot: Ballot;
@@ -5123,21 +5857,21 @@ export interface UnsealedEntry {
 /**
  * A sealed cast that did not open, or opened to no valid ballot: not counted (CONVENTIONS §9.7).
  */
-export interface SpoiledEntry {
+export interface SpoiledEntry_VotingV0_2 {
   kind: "spoiled";
   leafIndex: number;
 }
 /**
  * One step of the trustees' ceremony — an enrolment, a dealing, a confirmation or a justification — as the trustee's own signed request, so that anyone reading the board can tell who took it (CONVENTIONS §9.6).
  */
-export interface TrusteeStepEntry {
+export interface TrusteeStepEntry_VotingV0_2 {
   kind: "trusteeStep";
   request: SignedRequest;
 }
 /**
  * The community's voting/trustees/authorize request, exactly as the ballot box received it: the decryption targets of a closed election, pinned by digest to a head of the board (CONVENTIONS §9.7).
  */
-export interface DecryptionAuthorizedEntry {
+export interface DecryptionAuthorizedEntry_VotingV0_2 {
   kind: "decryptionAuthorized";
   request: SignedRequest;
 }
@@ -5177,7 +5911,7 @@ export interface Bootstrap {
 /**
  * How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.
  */
-export interface BreakGlass {
+export interface BreakGlass_GitNsV0_4 {
   /**
    * Who broke the glass: always the record's `subject`, restated so the flag reads on its own.
    */
@@ -5203,6 +5937,35 @@ export interface BreakGlass {
    */
   ratifiedAt?: string;
 }
+/**
+ * How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.
+ */
+export interface BreakGlass_GitNsV0_6 {
+  /**
+   * Who broke the glass: always the record's `subject`, restated so the flag reads on its own.
+   */
+  by: Did_GitNsV0_3;
+  /**
+   * When the VTC recorded the break-glass.
+   */
+  recordedAt: string;
+  /**
+   * The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.
+   */
+  justification: string;
+  /**
+   * When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `recordedAt`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.
+   */
+  effectiveAt?: string;
+  /**
+   * The administrator who ratified the record — never its subject. Absent while unratified.
+   */
+  ratifiedBy?: Did_GitNsV0_3;
+  /**
+   * When it was ratified. Present exactly when `ratifiedBy` is.
+   */
+  ratifiedAt?: string;
+}
 /**
  * A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.
  */
@@ -5516,8 +6279,43 @@ export interface CommunityProfileView {
  * One room the community owns, as its administrators see it.
  */
 export interface CommunityRoom {
-  room: HostedRoom;
+  room: HostedRoom_VtcV0_1;
+  label: RoomLabel;
+  /**
+   * The storage config receiving the room's new uploads.
+   */
+  storageConfig?: StorageConfigId;
+  /**
+   * Members in state `admitted`.
+   */
+  admitted: number;
+  /**
+   * Offers not yet accepted or withdrawn.
+   */
+  offered: number;
+  /**
+   * When the community's own `admin` authority over the room expires. A room whose owner's authority lapses can no longer advance its epoch, admit or remove; a community SHOULD renew it well before.
+   */
+  ownerAuthorityValidUntil?: string;
+  /**
+   * The administrator who created it.
+   */
+  createdBy?: string;
+}
+/**
+ * What vtc/rooms/community/{create,get,list}/0.2 and vtc/rooms/community/update/0.1 return: `CommunityRoom` plus the details an administrator keeps track of a room by — `description`, `tags`, and who last changed them and when. A separate definition, not a change to `CommunityRoom`, so that the 0.1 versions of those tasks keep the exact shape they published. The room's creation is `room.createdAt` and `createdBy`.
+ */
+export interface CommunityRoomV2_VtcV0_1 {
+  room: HostedRoom_VtcV0_1;
   label: RoomLabel;
+  /**
+   * Absent when the room has none.
+   */
+  description?: RoomDescription;
+  /**
+   * Absent or empty when the room has none.
+   */
+  tags?: RoomTags;
   /**
    * The storage config receiving the room's new uploads.
    */
@@ -5538,12 +6336,20 @@ export interface CommunityRoom {
    * The administrator who created it.
    */
   createdBy?: string;
+  /**
+   * When `label`, `description` or `tags` last changed. Absent until the first change after creation. Distinct from `room.updatedAt`, which is the host record's and moves with the room's epoch and lifecycle.
+   */
+  detailsUpdatedAt?: string;
+  /**
+   * The administrator who made that change. Present exactly when `detailsUpdatedAt` is. The earlier values and who set them are in the community's audit trail, not here.
+   */
+  detailsUpdatedBy?: string;
 }
 /**
  * What vtc/rooms/community/{create,get,list}/0.2 and vtc/rooms/community/update/0.1 return: `CommunityRoom` plus the details an administrator keeps track of a room by — `description`, `tags`, and who last changed them and when. A separate definition, not a change to `CommunityRoom`, so that the 0.1 versions of those tasks keep the exact shape they published. The room's creation is `room.createdAt` and `createdBy`.
  */
-export interface CommunityRoomV2 {
-  room: HostedRoom;
+export interface CommunityRoomV2_VtcV0_3 {
+  room: HostedRoom_VtcV0_3;
   label: RoomLabel;
   /**
    * Absent when the room has none.
@@ -6420,6 +7226,69 @@ export interface DidTemplateRecord_VtaV0_2 {
    */
   createdBy: string;
 }
+/**
+ * A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.
+ */
+export interface DidTemplateRecord_VtaV0_7 {
+  /**
+   * Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others.
+   */
+  schemaVersion: 1 | 2;
+  name: string;
+  kind: string;
+  description?: string | null;
+  methods?: string[];
+  requiredVars?: string[];
+  optionalVars?: {
+    [k: string]: unknown | undefined;
+  };
+  defaults?: {
+    [k: string]: unknown | undefined;
+  };
+  /**
+   * The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.
+   *
+   * A slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.
+   *
+   * An implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal.
+   */
+  keys?: {
+    [k: string]:
+      | {
+          /**
+           * What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree.
+           */
+          purpose: "signing" | "keyAgreement";
+          /**
+           * Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `["mldsa44", "ed25519"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to.
+           *
+           * @minItems 1
+           */
+          algorithms: [
+            "ed25519" | "x25519" | "p256" | "mldsa44" | "mldsa65",
+            ...("ed25519" | "x25519" | "p256" | "mldsa44" | "mldsa65")[]
+          ];
+        }
+      | undefined;
+  };
+  document: {};
+  /**
+   * Resolved scope of the stored template.
+   */
+  scope: Scope_VtaV0_1;
+  /**
+   * When the template was first stored (RFC 3339).
+   */
+  createdAt: string;
+  /**
+   * When the template was last written (RFC 3339).
+   */
+  updatedAt: string;
+  /**
+   * DID of the admin who last wrote the template.
+   */
+  createdBy: string;
+}
 /**
  * Authored template shape: a DID document with `{TOKEN}` placeholders plus the variable contract the VTA's renderer enforces.
  */
@@ -6751,7 +7620,7 @@ export interface DomainEntry {
 /**
  * A DIDComm mediator that is no longer advertised but is still accepting delivery, so in-flight messages routed through it are not stranded.
  */
-export interface DrainEntry {
+export interface DrainEntry_VtaV0_1 {
   /**
    * The mediator being drained.
    */
@@ -6766,10 +7635,56 @@ export interface DrainEntry {
   drainsUntil: string;
   ext?: Ext;
 }
+/**
+ * A DIDComm mediator that is no longer advertised but is still accepting delivery, so in-flight messages routed through it are not stranded.
+ */
+export interface DrainEntry_VtaV0_8 {
+  /**
+   * The mediator being drained.
+   */
+  mediatorDid: string;
+  /**
+   * Where it is still reachable for the remainder of the drain.
+   */
+  endpoint: string;
+  /**
+   * RFC 3339 instant after which the mediator is dropped and messages routed through it are lost.
+   */
+  drainEndsAt: string;
+  ext?: Ext;
+}
+/**
+ * One difference between the forge's observed state and the VTC's projection of a repository.
+ */
+export interface DriftItem_GitNsV0_1 {
+  /**
+   * `roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.
+   */
+  type:
+    | "roleAdded"
+    | "roleRemoved"
+    | "roleChanged"
+    | "requiredCheckMissing"
+    | "protectionWeakened"
+    | "bootstrapMissing";
+  resource: RepoResource_GitNsV0_1;
+  /**
+   * Whose role differs, for the three role types.
+   */
+  account?: ForgeAccount_GitNsV0_1;
+  /**
+   * What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.
+   */
+  observed?: string;
+  /**
+   * What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing.
+   */
+  expected?: string;
+}
 /**
  * One difference between the forge's observed state and the VTC's projection of a repository.
  */
-export interface DriftItem {
+export interface DriftItem_GitNsV0_6 {
   /**
    * `roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.
    */
@@ -6780,11 +7695,11 @@ export interface DriftItem {
     | "requiredCheckMissing"
     | "protectionWeakened"
     | "bootstrapMissing";
-  resource: RepoResource;
+  resource: RepoResource_GitNsV0_6;
   /**
    * Whose role differs, for the three role types.
    */
-  account?: ForgeAccount;
+  account?: ForgeAccount_GitNsV0_6;
   /**
    * What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.
    */
@@ -7210,20 +8125,67 @@ export interface Exposure {
    */
   discloses: "none" | "metadata" | "secret";
   /**
-   * Whether execution exercises the subject's own authority to produce an attributable effect in the subject's name.
+   * Whether execution exercises the subject's own authority to produce an attributable effect in the subject's name.
+   */
+  actsAsSubject: boolean;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext {
+  [k: string]: unknown | undefined;
+}
+/**
+ * An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.
+ */
+export interface ExternalAccount_ExternalV0_1 {
+  id: AccountId;
+  /**
+   * Display name. Untrusted text: render it, never interpret it.
+   */
+  label: string;
+  context: AccountContextId;
+  settings: AccountSettings;
+  state: AccountState;
+  /**
+   * Absent for the static models, which hold a secret rather than a key.
+   */
+  publicMaterial?: AccountPublicMaterial;
+  /**
+   * Static models only; absent until the secret is set.
+   */
+  secret?: AccountSecretInfo;
+  /**
+   * @maxItems 256
+   */
+  bindings: AccountBinding[];
+  /**
+   * The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.
+   *
+   * @maxItems 8
+   */
+  egressHosts:
+    | []
+    | [string]
+    | [string, string]
+    | [string, string, string]
+    | [string, string, string, string]
+    | [string, string, string, string, string]
+    | [string, string, string, string, string, string]
+    | [string, string, string, string, string, string, string]
+    | [string, string, string, string, string, string, string, string];
+  /**
+   * True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.
    */
-  actsAsSubject: boolean;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
+  providerSetupRequired: boolean;
+  lastProbe?: AccountProbeReport_ExternalV0_1;
+  createdAt: string;
+  updatedAt: string;
 }
 /**
  * An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.
  */
-export interface ExternalAccount {
+export interface ExternalAccount_ExternalV0_2 {
   id: AccountId;
   /**
    * Display name. Untrusted text: render it, never interpret it.
@@ -7263,7 +8225,7 @@ export interface ExternalAccount {
    * True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.
    */
   providerSetupRequired: boolean;
-  lastProbe?: AccountProbeReport;
+  lastProbe?: AccountProbeReport_ExternalV0_2;
   createdAt: string;
   updatedAt: string;
 }
@@ -7458,9 +8420,20 @@ export interface FileManifest {
 /**
  * A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.
  */
-export interface ForgeAccount {
-  forge: ForgeHost;
-  id: ForgeId;
+export interface ForgeAccount_GitNsV0_1 {
+  forge: ForgeHost_GitNsV0_1;
+  id: ForgeId_GitNsV0_1;
+  /**
+   * The account's current login, as the forge reported it when last seen. Display only.
+   */
+  login: string;
+}
+/**
+ * A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.
+ */
+export interface ForgeAccount_GitNsV0_6 {
+  forge: ForgeHost_GitNsV0_6;
+  id: ForgeId_GitNsV0_6;
   /**
    * The account's current login, as the forge reported it when last seen. Display only.
    */
@@ -7477,13 +8450,13 @@ export interface GcsSettings {
 /**
  * The VTC's binding to one owner on one forge.
  */
-export interface GitNamespace {
+export interface GitNamespace_GitNsV0_1 {
   id: NamespaceId;
-  forge: ForgeHost;
+  forge: ForgeHost_GitNsV0_1;
   /**
    * The organisation or user on the forge, lowercased.
    */
-  owner: Segment;
+  owner: Segment_GitNsV0_1;
   /**
    * Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.
    */
@@ -7497,6 +8470,29 @@ export interface GitNamespace {
    */
   state: "pending" | "bound";
 }
+/**
+ * The VTC's binding to one owner on one forge.
+ */
+export interface GitNamespace_GitNsV0_6 {
+  id: NamespaceId;
+  forge: ForgeHost_GitNsV0_6;
+  /**
+   * The organisation or user on the forge, lowercased.
+   */
+  owner: Segment_GitNsV0_6;
+  /**
+   * Whether the owner is an organisation or a personal account, as the forge reports it; a GitLab top-level group is an `organization`. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.
+   */
+  kind?: "organization" | "user";
+  /**
+   * `bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone.
+   */
+  mode: "bridge" | "manual";
+  /**
+   * `pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace.
+   */
+  state: "pending" | "bound";
+}
 /**
  * A grant set the group confers: each capability is written onto every member's access-control entry as a resource grant whose source is the group, bounded by the member's role ceiling and by the binder's own holdings.
  */
@@ -7697,7 +8693,7 @@ export interface HistogramBucket {
 /**
  * One room, as its host holds it — member for member the `HostedRoom` of vtc/rooms/list/0.1, which defines it inside its own payload schema. Nothing derived from the room's contents, and no member list: the host has none.
  */
-export interface HostedRoom {
+export interface HostedRoom_VtcV0_1 {
   roomId: string;
   ownerDid: string;
   visibility: Visibility;
@@ -7710,6 +8706,22 @@ export interface HostedRoom {
   createdAt: number;
   updatedAt: number;
 }
+/**
+ * One room, as its host holds it — member for member the `HostedRoom` of vtc/rooms/list/0.2, which defines it inside its own payload schema. Nothing derived from the room's contents, and no member list: the host has none.
+ */
+export interface HostedRoom_VtcV0_3 {
+  roomId: string;
+  ownerDid: string;
+  visibility: Visibility;
+  retentionPolicy: RetentionPolicy;
+  epoch: number;
+  lifecycle: "live" | "lapsed" | "dormant" | "reclaimable";
+  epochExpiresAt?: string;
+  retentionDays: number;
+  mirrorOf?: string;
+  createdAt: string;
+  updatedAt: string;
+}
 /**
  * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.
  *
@@ -7753,7 +8765,7 @@ export interface HpkeArmoredEnvelope_VaultV0_2 {
 /**
  * Whether the edge is in force now, and if not, why not — the edge's resolved state, which is not the same thing as the event just recorded: restoring an edge whose `validUntil` passed while it was suspended records the restoration and still resolves `expired`. Exactly the members its `state` names are present.
  */
-export interface InForce {
+export interface InForce_VtcV0_1 {
   /**
    * `yes`: inside its window, nothing standing against it. `notYetValid`: its `validFrom` has not arrived. `expired`: its `validUntil` has passed. `suspended`: temporarily ineffective — the only non-`yes` state a lifecycle event can reverse. `superseded`: displaced by a later credential. `withdrawn`: terminal. `indeterminate`: the credential's own window could not be read, so no honest answer is available.
    */
@@ -7783,6 +8795,39 @@ export interface InForce {
    */
   reason?: string;
 }
+/**
+ * Whether the edge is in force now, and if not, why not — the edge's resolved state, which is not the same thing as the event just recorded: restoring an edge whose `validUntil` passed while it was suspended records the restoration and still resolves `expired`. Exactly the members its `state` names are present.
+ */
+export interface InForce_VtcV0_4 {
+  /**
+   * `yes`: inside its window, nothing standing against it. `notYetValid`: its `validFrom` has not arrived. `expired`: its `validUntil` has passed. `suspended`: temporarily ineffective — the only non-`yes` state a lifecycle event can reverse. `superseded`: displaced by a later credential. `withdrawn`: terminal. `indeterminate`: the credential's own window could not be read, so no honest answer is available.
+   */
+  state: "yes" | "notYetValid" | "expired" | "suspended" | "superseded" | "withdrawn" | "indeterminate";
+  /**
+   * Present for `notYetValid`.
+   */
+  validFrom?: string;
+  /**
+   * Present for `expired`.
+   */
+  validUntil?: string;
+  /**
+   * Present for `suspended`: when the standing suspension was recorded.
+   */
+  since?: string;
+  /**
+   * Present for `superseded` and `withdrawn`: when the edge stopped being in force.
+   */
+  endedAt?: string;
+  /**
+   * Present for `superseded`: the digest of the credential that displaced it.
+   */
+  by?: string;
+  /**
+   * Present for `indeterminate`: why the window could not be read. Written by the community.
+   */
+  reason?: string;
+}
 /**
  * Registry view of one issued Invitation Credential. Carries no credential material — the VIC itself is returned only once, by `issue`.
  */
@@ -8121,7 +9166,7 @@ export interface LocalSettings {
 /**
  * What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).
  */
-export interface Manifest {
+export interface Manifest_VotingV0_1 {
   electionId: ElectionId;
   /**
    * The community's DID.
@@ -8163,6 +9208,51 @@ export interface Manifest {
    */
   textReleaseThreshold: number;
 }
+/**
+ * What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).
+ */
+export interface Manifest_VotingV0_2 {
+  electionId: ElectionId;
+  /**
+   * The community's DID.
+   */
+  community: string;
+  title?: string;
+  description?: string;
+  /**
+   * @minItems 1
+   * @maxItems 128
+   */
+  questions: [Question, ...Question[]];
+  secrecy: SecrecyLevel;
+  roll: RollRule;
+  registrationOpensAt: string;
+  votingOpensAt: string;
+  votingClosesAt: string;
+  revote: Revote;
+  board: {
+    visibility: BoardVisibility;
+    auditors: string[];
+  };
+  /**
+   * The DID of the voting service that holds the board.
+   */
+  ballotBox: string;
+  trustees?: Trustees;
+  /**
+   * Whether the community treats the result as deciding something; creating a binding election takes another administrator's consent (VTI-VOT-081).
+   */
+  binding: boolean;
+  allowEarlyClose: boolean;
+  /**
+   * Open elections only: whether running totals may be read while voting is open (VTI-VOT-061).
+   */
+  resultsBeforeClose: boolean;
+  /**
+   * Counted ballots required before any text answer is disclosed (VTI-VOT-065).
+   */
+  textReleaseThreshold: number;
+}
 /**
  * The mediator's per-account access-control capability set, expressed as named booleans (the transport-agnostic form of the mediator's internal capability flags). On a set request, members omitted are left unchanged; a get/response carries the full realized set.
  */
@@ -8363,7 +9453,7 @@ export interface MetricsSnapshot {
 /**
  * One observed step in the life of one message at the mediator. Carries metadata only — never a message body.
  */
-export interface MonitorEvent {
+export interface MonitorEvent_MessagingV0_1 {
   /**
    * When the step happened, with sub-second precision where the mediator has it.
    */
@@ -8401,6 +9491,47 @@ export interface MonitorEvent {
    */
   latencyMs?: number;
 }
+/**
+ * One observed step in the life of one message at the mediator. Carries metadata only — never a message body.
+ */
+export interface MonitorEvent_MessagingV0_3 {
+  /**
+   * When the step happened, with sub-second precision where the mediator has it.
+   */
+  occurredAt: string;
+  direction: TrafficDirection;
+  stage: TrafficStage;
+  channel: TrafficChannel;
+  protocol: WireProtocol;
+  /**
+   * The stored message's identifier, once it has one; correlates the events of one message and matches MessageMeta.msgId.
+   */
+  msgId?: string;
+  /**
+   * The sender, where the mediator knows it.
+   */
+  from?: Vid;
+  /**
+   * The recipient, where the mediator knows it.
+   */
+  to?: Vid;
+  /**
+   * Frame size in bytes.
+   */
+  size?: number;
+  /**
+   * The plaintext message type, present only when the mediator itself was the addressee and read it (a routing forward, a pickup request, a trust-task type URI, a trust ping). Absent for end-to-end-encrypted traffic the mediator only relays.
+   */
+  messageType?: string;
+  /**
+   * Present when stage is `refused`, and on any other stage that failed.
+   */
+  outcome?: TrafficOutcome;
+  /**
+   * For `delivered` and `forwarded`: milliseconds since the message was stored.
+   */
+  latencyMs?: number;
+}
 /**
  * Selects which events a monitor subscription receives. Every member present narrows the selection (members are ANDed; values within one member are ORed). An empty filter selects everything the requester is entitled to see.
  */
@@ -9544,7 +10675,7 @@ export interface RecordMetadataV2 {
  *
  * **What a host keeps and what it does not.** A host keeps this marker, and in its audit trail the prune's `reason`, its requester where the tier discloses one, and the retention it was made under. It MUST NOT keep anything a pruned record said — body, ciphertext, cleartext, title, description, file or blob — and SHOULD NOT keep pruned records' keys: the count is the audit, and a list of keys on an `open` room, where keys may be descriptive, is content by another name.
  */
-export interface RecordPrune {
+export interface RecordPrune_RoomsV0_1 {
   /**
    * The version the prune took from the room's counter, as a put or a curation would. No record carries it; it is what moves `HeadVersion` past the removal, so that a root taken before and a root taken after are never labelled with one version.
    */
@@ -9558,6 +10689,27 @@ export interface RecordPrune {
    */
   removed: number;
 }
+/**
+ * The mark a prune leaves: **that** records were removed, when, and how many — never which, and never anything they said.
+ *
+ * A prune removes records outright, tombstones included, so the room's record tree loses leaves and an incremental reader has nothing left to learn the removal from. This is what it learns from instead. A host keeps the latest one per room and serves it with every listing that can carry it (`rooms/records/list` 0.3, as `lastPrune`); a reader whose own copy of the room was synchronised to a version below `version` MUST rebuild that copy from a full listing — no `sinceVersion` — and drop every record the full listing no longer holds. Without that, a record the room removed lives on in every cache that synchronised before the prune, and a record retracted while the reader was away comes back as current.
+ *
+ * **What a host keeps and what it does not.** A host keeps this marker, and in its audit trail the prune's `reason`, its requester where the tier discloses one, and the retention it was made under. It MUST NOT keep anything a pruned record said — body, ciphertext, cleartext, title, description, file or blob — and SHOULD NOT keep pruned records' keys: the count is the audit, and a list of keys on an `open` room, where keys may be descriptive, is content by another name.
+ */
+export interface RecordPrune_RoomsV0_2 {
+  /**
+   * The version the prune took from the room's counter, as a put or a curation would. No record carries it; it is what moves `HeadVersion` past the removal, so that a root taken before and a root taken after are never labelled with one version.
+   */
+  version: number;
+  /**
+   * When the host performed it.
+   */
+  prunedAt: string;
+  /**
+   * How many records were removed, tombstones included. A prune that removed nothing leaves no mark.
+   */
+  removed: number;
+}
 /**
  * How long a room keeps its records, by age: the room's **record retention**. Records older than it states become **eligible** to be removed by `rooms/records/prune`; nothing is removed until a holder of `admin` asks for a prune, and nothing a prune removes can be brought back.
  *
@@ -9606,6 +10758,27 @@ export interface RegisteredCredential {
    */
   lastUsedAt?: string;
 }
+/**
+ * The `ServiceInstance` shape of `did-management/_shared/0.1`, with `lastSeen` renamed `lastSeenAt`; named apart from `service-instance.schema.json`'s `ServiceInstance`, a different shape, so the two do not collide in generated code.
+ */
+export interface RegisteredInstance {
+  /**
+   * Stable identifier the control plane uses for this instance. SHOULD be derived from the instance's DID (e.g. `did:web:host.example` → `did_web_host_example`) so it survives restarts.
+   */
+  instanceId: string;
+  /**
+   * VID identifying the registered service.
+   */
+  did: string;
+  label?: string;
+  publicUrl?: string;
+  /**
+   * Hosting domains this instance currently serves. Updated by `domain/assign` / `domain/unassign` ack flow.
+   */
+  servedDomains?: string[];
+  lastSeenAt?: string;
+  ext?: Ext;
+}
 /**
  * A key a patch declined to apply, with the reason.
  */
@@ -9616,10 +10789,23 @@ export interface RejectedKey {
    */
   reason: string;
 }
+/**
+ * The two credentials a renewal replaces, serialized as rooms/owner/{issue-membership,issue-authority} return them: a membership and an authority granting the same actions until the renewal's `validUntil`. No invitation: the member is already admitted, and a renewal never opens a second way in. The member's surface stores each with the member's key holder **in place of** the one it renews, never beside it.
+ */
+export interface RenewalCredentials {
+  /**
+   * The renewed Verifiable Membership Credential.
+   */
+  membership: string;
+  /**
+   * The renewed Verifiable Authority Credential granting `actions` until `validUntil`.
+   */
+  authority: string;
+}
 /**
  * What vtc/rooms/offers/list/0.3 returns in `renewals`: a renewal of an admission the member already holds, as the member it is addressed to sees it. `label` and `description` are the room's as they stand when it is read.
  */
-export interface Renewal {
+export interface Renewal_VtcV0_1 {
   roomId: string;
   /**
    * The room's host: this community.
@@ -9644,27 +10830,62 @@ export interface Renewal {
   credentials: RenewalCredentials;
 }
 /**
- * The two credentials a renewal replaces, serialized as rooms/owner/{issue-membership,issue-authority} return them: a membership and an authority granting the same actions until the renewal's `validUntil`. No invitation: the member is already admitted, and a renewal never opens a second way in. The member's surface stores each with the member's key holder **in place of** the one it renews, never beside it.
+ * What vtc/rooms/offers/list/0.4 returns in `renewals`: a renewal of an admission the member already holds, as the member it is addressed to sees it. `label` and `description` are the room's as they stand when it is read.
  */
-export interface RenewalCredentials {
+export interface Renewal_VtcV0_4 {
+  roomId: string;
   /**
-   * The renewed Verifiable Membership Credential.
+   * The room's host: this community.
    */
-  membership: string;
+  host: string;
+  label: RoomLabel;
+  /**
+   * Absent when the room has none.
+   */
+  description?: RoomDescription;
+  visibility: Visibility;
+  actions: MemberActions;
+  /**
+   * When the renewed authority expires.
+   */
+  validUntil: string;
+  /**
+   * When the authority it replaces expires: the renewal is listed until then, or until a later renewal or the member's removal supersedes it.
+   */
+  renewsAt: string;
+  issuedAt: string;
+  credentials: RenewalCredentials;
+}
+/**
+ * One repository as the VTC records it.
+ */
+export interface RepoSummary_GitNsV0_1 {
+  resource: RepoResource_GitNsV0_1;
+  /**
+   * The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).
+   */
+  forgeId?: ForgeId_GitNsV0_1;
+  visibility: RepoVisibility;
+  /**
+   * `pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.
+   */
+  state: "pendingCreate" | "active" | "archived" | "detached" | "orphaned" | "unmanaged";
   /**
-   * The renewed Verifiable Authority Credential granting `actions` until `validUntil`.
+   * The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.
    */
-  authority: string;
+  owners: Did_GitNsV0_1[];
+  bootstrap: Bootstrap;
+  sync: Sync_GitNsV0_1;
 }
 /**
  * One repository as the VTC records it.
  */
-export interface RepoSummary_GitNsV0_1 {
-  resource: RepoResource;
+export interface RepoSummary_GitNsV0_3 {
+  resource: RepoResource_GitNsV0_1;
   /**
    * The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).
    */
-  forgeId?: ForgeId;
+  forgeId?: ForgeId_GitNsV0_1;
   visibility: RepoVisibility;
   /**
    * `pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.
@@ -9673,19 +10894,19 @@ export interface RepoSummary_GitNsV0_1 {
   /**
    * The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.
    */
-  owners: Did_GitNsV0_1[];
+  owners: Did_GitNsV0_3[];
   bootstrap: Bootstrap;
-  sync: Sync;
+  sync: Sync_GitNsV0_1;
 }
 /**
  * One repository as the VTC records it.
  */
-export interface RepoSummary_GitNsV0_3 {
-  resource: RepoResource;
+export interface RepoSummary_GitNsV0_6 {
+  resource: RepoResource_GitNsV0_6;
   /**
    * The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).
    */
-  forgeId?: ForgeId;
+  forgeId?: ForgeId_GitNsV0_6;
   visibility: RepoVisibility;
   /**
    * `pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.
@@ -9696,7 +10917,7 @@ export interface RepoSummary_GitNsV0_3 {
    */
   owners: Did_GitNsV0_3[];
   bootstrap: Bootstrap;
-  sync: Sync;
+  sync: Sync_GitNsV0_6;
 }
 export interface RequestedAttribute {
   /**
@@ -9868,7 +11089,7 @@ export interface RightRecord_GitNsV0_1 {
    */
   subject: Did_GitNsV0_1;
   right: Right;
-  resource: Resource;
+  resource: Resource_GitNsV0_1;
   /**
    * The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.
    */
@@ -9892,7 +11113,7 @@ export interface RightRecord_GitNsV0_3 {
    */
   subject: Did_GitNsV0_3;
   right: Right;
-  resource: Resource;
+  resource: Resource_GitNsV0_1;
   /**
    * The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.
    */
@@ -9916,7 +11137,35 @@ export interface RightRecord_GitNsV0_4 {
    */
   subject: Did_GitNsV0_3;
   right: Right;
-  resource: Resource;
+  resource: Resource_GitNsV0_1;
+  /**
+   * The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.
+   */
+  grantedBy: Did_GitNsV0_3;
+  grantedAt: string;
+  /**
+   * When the right lapses. Absent: no expiry.
+   */
+  expiresAt?: string;
+  /**
+   * The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.
+   */
+  reason?: string;
+  /**
+   * Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.
+   */
+  breakGlass?: BreakGlass_GitNsV0_4;
+}
+/**
+ * One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.
+ */
+export interface RightRecord_GitNsV0_6 {
+  /**
+   * Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.
+   */
+  subject: Did_GitNsV0_3;
+  right: Right;
+  resource: Resource_GitNsV0_6;
   /**
    * The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.
    */
@@ -9933,7 +11182,7 @@ export interface RightRecord_GitNsV0_4 {
   /**
    * Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.
    */
-  breakGlass?: BreakGlass;
+  breakGlass?: BreakGlass_GitNsV0_6;
 }
 /**
  * A grant set by reference: the capability ceiling of a defined role, conferred as resource grants exactly as a `grants` binding confers its list. It never assigns the role itself — an entry's administrative role and its community role stay direct assignments.
@@ -10098,7 +11347,7 @@ export interface RollRule {
 /**
  * The outcome of a rollback. Distinct from ServiceMutationResult because a rollback can legitimately publish nothing: if the previous state already equals the current one there is no change to write, and `kind: "noOp"` says so with `logEntryVersionId` absent. Treating that as a failure would be wrong — the requested state holds — and treating it as an ordinary success would report a log entry that does not exist.
  */
-export interface RollbackResult {
+export interface RollbackResult_VtaV0_1 {
   /**
    * What the rollback did. `disabled` re-disabled the transport, `enabled` re-advertised it at its prior settings, `updated` restored prior settings on an entry that stayed advertised, and `noOp` means the previous state already matched — nothing was written.
    */
@@ -10129,6 +11378,40 @@ export interface RollbackResult {
   serverless?: boolean;
   ext?: Ext;
 }
+/**
+ * The outcome of a rollback. Distinct from ServiceMutationResult because a rollback can legitimately publish nothing: if the previous state already equals the current one there is no change to write, and `kind: "noOp"` says so with `logEntryVersionId` absent. Treating that as a failure would be wrong — the requested state holds — and treating it as an ordinary success would report a log entry that does not exist.
+ */
+export interface RollbackResult_VtaV0_8 {
+  /**
+   * What the rollback did. `disabled` re-disabled the transport, `enabled` re-advertised it at its prior settings, `updated` restored prior settings on an entry that stayed advertised, and `noOp` means the previous state already matched — nothing was written.
+   */
+  kind: "disabled" | "enabled" | "updated" | "noOp";
+  /**
+   * Version id of the log entry the rollback wrote. **Absent when `kind` is `noOp`**, and present otherwise.
+   */
+  logEntryVersionId?: string;
+  /**
+   * RFC 3339 instant the rollback took effect. Absent for `noOp`.
+   */
+  effectiveAt?: string;
+  /**
+   * Present when rolling back DIDComm left a mediator draining.
+   */
+  drainingMediator?: string;
+  /**
+   * When that drain completes.
+   */
+  drainEndsAt?: string;
+  /**
+   * The agent's own DID.
+   */
+  vtaDid?: string;
+  /**
+   * True when the entry was written locally but not published — the operator must redeploy before any verifier sees it.
+   */
+  serverless?: boolean;
+  ext?: Ext;
+}
 /**
  * Links a room the community owns to the group: joining the group offers the member admission to the room with `actions`, valid for `validFor`, renewed while they stay in the group (collected with vtc/rooms/offers/list at 0.3 or later); leaving removes them unless another source still covers them.
  */
@@ -10534,11 +11817,11 @@ export interface ServiceInstance_DidManagementV0_2 {
   /**
    * The last document the control plane received from this instance. Absent when it has received none.
    */
-  lastInbound?: TransportObservation;
+  lastInbound?: TransportObservation_DidManagementV0_2;
   /**
    * The last document the control plane delivered to this instance. Absent when it has delivered none.
    */
-  lastOutbound?: TransportObservation;
+  lastOutbound?: TransportObservation_DidManagementV0_2;
   /**
    * When the instance last answered a health probe. Absent when it never has.
    */
@@ -10546,10 +11829,66 @@ export interface ServiceInstance_DidManagementV0_2 {
   registeredAt: string;
   ext?: Ext;
 }
+export interface ServiceInstance_DidManagementV0_3 {
+  /**
+   * Stable identifier the control plane uses for this instance. SHOULD be derived from the instance's DID so it survives restarts.
+   */
+  instanceId: string;
+  /**
+   * The instance's own DID — the identity its signed documents are verified against and the one the control plane addresses.
+   */
+  did: string;
+  /**
+   * `server` — a hosting server (edge) that resolves DIDs the control plane syncs to it. `witness` — a did:webvh witness. `watcher` — a did:webvh watcher that mirrors logs.
+   */
+  serviceType: "server" | "witness" | "watcher";
+  /**
+   * Operator-chosen display label. Untrusted free text.
+   */
+  label?: string;
+  /**
+   * The instance's public base URL, where it serves DID resolution. Absent when the instance registered without one.
+   */
+  publicUrl?: string;
+  /**
+   * The control plane's current verdict, from the instance's last answered health probe. `degraded` — answered late; `unreachable` — has not answered within the control plane's configured window.
+   */
+  status: "active" | "degraded" | "unreachable";
+  /**
+   * Hosting domains the instance has acknowledged serving. Always present — empty for an instance that serves none, which includes every `witness` and `watcher`.
+   */
+  servedDomains: string[];
+  /**
+   * DID methods the instance can host (e.g. `webvh`, `web`, `webs`), as it declared at registration.
+   */
+  enabledMethods?: string[];
+  /**
+   * `service[].type` values of the instance's DID document when the control plane last resolved it. Display only: nothing is routed on it. Absent when the document has not been resolved.
+   */
+  advertisedServices?: string[];
+  /**
+   * When `advertisedServices` was last resolved. Absent with it.
+   */
+  servicesCheckedAt?: string;
+  /**
+   * The last document the control plane received from this instance. Absent when it has received none.
+   */
+  lastInbound?: TransportObservation_DidManagementV0_3;
+  /**
+   * The last document the control plane delivered to this instance. Absent when it has delivered none.
+   */
+  lastOutbound?: TransportObservation_DidManagementV0_3;
+  /**
+   * When the instance last answered a health probe. Absent when it never has.
+   */
+  lastHealthCheckAt?: string;
+  registeredAt: string;
+  ext?: Ext;
+}
 /**
  * The outcome of a change to an advertised service. Every member describes the **log entry the change produced**, because that is what the change actually is: the agent's DID document is the record, and a consumer that treats the response as a mere acknowledgement will miss that a redeploy may be required.
  */
-export interface ServiceMutationResult {
+export interface ServiceMutationResult_VtaV0_1 {
   /**
    * Version id of the new did:webvh log entry this change wrote. Joins the change to the document's history.
    */
@@ -10576,10 +11915,40 @@ export interface ServiceMutationResult {
   serverless?: boolean;
   ext?: Ext;
 }
+/**
+ * The outcome of a change to an advertised service. Every member describes the **log entry the change produced**, because that is what the change actually is: the agent's DID document is the record, and a consumer that treats the response as a mere acknowledgement will miss that a redeploy may be required.
+ */
+export interface ServiceMutationResult_VtaV0_8 {
+  /**
+   * Version id of the new did:webvh log entry this change wrote. Joins the change to the document's history.
+   */
+  logEntryVersionId: string;
+  /**
+   * RFC 3339 instant the change took effect — the same instant stamped on the new log entry.
+   */
+  effectiveAt: string;
+  /**
+   * Present when the change scheduled a DIDComm drain. Its absence means no drain was scheduled, NOT that a drain finished instantly: a consumer reporting 'done' on an absent value would be right, and one reporting it on a present value would be wrong.
+   */
+  drainEndsAt?: string;
+  /**
+   * The mediator being drained, when `drainEndsAt` is present.
+   */
+  drainingMediator?: string;
+  /**
+   * The agent's own DID — subject of the log entry this change wrote. Carried so a caller can follow up without a second round trip.
+   */
+  vtaDid?: string;
+  /**
+   * True when the agent's DID is self-hosted. **The change is persisted locally but NOT published**: the operator must fetch the updated `did.jsonl` and redeploy before any verifier sees it. A consumer that ignores this reports success for a change no one else can observe yet.
+   */
+  serverless?: boolean;
+  ext?: Ext;
+}
 /**
  * What the agent currently advertises for one service. `enabled` is the only member every kind carries; the rest are kind-specific and absent when they do not apply. Note that `enabled: false` and an absent entry are different: the first says the agent knows about this transport and is not advertising it, the second says it has never been configured.
  */
-export interface ServiceState {
+export interface ServiceState_VtaV0_1 {
   kind: ServiceKind;
   /**
    * Whether the agent currently advertises this transport in its DID document.
@@ -10599,6 +11968,29 @@ export interface ServiceState {
   drainsUntil?: string;
   ext?: Ext;
 }
+/**
+ * What the agent currently advertises for one service. `enabled` is the only member every kind carries; the rest are kind-specific and absent when they do not apply. Note that `enabled: false` and an absent entry are different: the first says the agent knows about this transport and is not advertising it, the second says it has never been configured.
+ */
+export interface ServiceState_VtaV0_8 {
+  kind: ServiceKind;
+  /**
+   * Whether the agent currently advertises this transport in its DID document.
+   */
+  enabled: boolean;
+  /**
+   * The mediator this transport routes through. Present for `didcomm` and `tsp`.
+   */
+  mediatorDid?: string;
+  /**
+   * The advertised endpoint. Present for `rest` and `webauthn`.
+   */
+  url?: string;
+  /**
+   * RFC 3339 instant at which a scheduled drain completes. Present only while a `didcomm` mediator is draining — see `vta/services/drain/list`.
+   */
+  drainEndsAt?: string;
+  ext?: Ext;
+}
 /**
  * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
  */
@@ -11178,23 +12570,6 @@ export interface Summary {
    */
   templateDigest: DigestMultibase;
 }
-/**
- * How the forge compares with the VTC's projection for one repository.
- */
-export interface Sync {
-  /**
-   * `inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).
-   */
-  state: "inSync" | "drift" | "pending" | "unchecked";
-  /**
-   * When the forge was last compared. Absent if never.
-   */
-  checkedAt?: string;
-  /**
-   * Outstanding drift. Empty unless `state` is `drift`.
-   */
-  drift: DriftItem[];
-}
 export interface SyncUpdate {
   /**
    * The slot path on its hosting domain (e.g. `alice`, `people/alice`, or `.well-known` for a root DID).
@@ -11222,6 +12597,40 @@ export interface SyncUpdate {
   disabled: boolean;
   ext?: Ext;
 }
+/**
+ * How the forge compares with the VTC's projection for one repository.
+ */
+export interface Sync_GitNsV0_1 {
+  /**
+   * `inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).
+   */
+  state: "inSync" | "drift" | "pending" | "unchecked";
+  /**
+   * When the forge was last compared. Absent if never.
+   */
+  checkedAt?: string;
+  /**
+   * Outstanding drift. Empty unless `state` is `drift`.
+   */
+  drift: DriftItem_GitNsV0_1[];
+}
+/**
+ * How the forge compares with the VTC's projection for one repository.
+ */
+export interface Sync_GitNsV0_6 {
+  /**
+   * `inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).
+   */
+  state: "inSync" | "drift" | "pending" | "unchecked";
+  /**
+   * When the forge was last compared. Absent if never.
+   */
+  checkedAt?: string;
+  /**
+   * Outstanding drift. Empty unless `state` is `drift`.
+   */
+  drift: DriftItem_GitNsV0_6[];
+}
 export interface Tier {
   /**
    * How the menu names it: desk, busy-desk.
@@ -11317,13 +12726,20 @@ export interface TransportKey {
   key: GroupElement;
   pok: SigmaProof;
 }
-export interface TransportObservation {
+export interface TransportObservation_DidManagementV0_2 {
   /**
    * The binding the document actually travelled on.
    */
   transport: "tsp" | "didcomm" | "https";
   at: string;
 }
+export interface TransportObservation_DidManagementV0_3 {
+  /**
+   * The binding the document actually travelled on.
+   */
+  transport: "tsp" | "didcomm" | "https";
+  observedAt: string;
+}
 export interface TrustRecord {
   entity_id: string;
   authority_id: string;
@@ -12125,7 +13541,7 @@ export interface WitnessKey {
 /**
  * The outcome of one write within a `vta/app-state/put-many` batch. Per-record rather than per-batch, because the default batch mode applies each write on its own merits: a caller flushing ten unrelated edits needs to know which one conflicted, not merely that something did.
  */
-export interface WriteResult {
+export interface WriteResult_VtaV0_1 {
   key: Key_VtaV0_1;
   /**
    * `written`: applied, and `version` carries the new value. `conflict`: `expectedVersion` did not match; `currentVersion`, `currentValue` and `currentDeleted` carry the maintainer's view so the caller can resolve without a re-read. `tooLarge`: the value exceeded the per-record cap; `limitBytes` and `actualBytes` say by how much. `notFound`: a `mergePatch` write named an address with no live record. `skipped`: atomic mode only — this write was not attempted because another in the batch failed.
@@ -12162,3 +13578,43 @@ export interface WriteResult {
    */
   actualBytes?: number;
 }
+/**
+ * The outcome of one write within a `vta/app-state/put-many` batch. Per-record rather than per-batch, because the default batch mode applies each write on its own merits: a caller flushing ten unrelated edits needs to know which one conflicted, not merely that something did.
+ */
+export interface WriteResult_VtaV0_7 {
+  key: Key_VtaV0_1;
+  /**
+   * `written`: applied, and `version` carries the new value. `conflict`: `expectedVersion` did not match; `currentVersion`, `currentValue` and `currentDeleted` carry the maintainer's view so the caller can resolve without a re-read. `tooLarge`: the value exceeded the per-record cap; `limitBytes` and `actualBytes` say by how much. `notFound`: a `mergePatch` write named an address with no live record. `skipped`: atomic mode only — this write was not attempted because another in the batch failed.
+   */
+  outcome: "written" | "conflict" | "tooLarge" | "notFound" | "skipped";
+  /**
+   * The new version, on `written`.
+   */
+  version?: Version_VtaV0_1;
+  /**
+   * On `written`: true when no live record existed at the address beforehand.
+   */
+  wasCreated?: boolean;
+  /**
+   * On `conflict`: the version the maintainer actually holds. Absent when the conflict is that no record exists (`expectedVersion` was positive and the address is empty).
+   */
+  currentVersion?: Version_VtaV0_1;
+  /**
+   * On `conflict`: the value the maintainer actually holds, returned WITH the rejection rather than left for the caller to re-read. A bare rejection has no fixed point under contention — between the rejection and the re-read the record can change again — so returning the winner's view removes the race rather than narrowing it. Absent when `currentDeleted` is true or no record exists.
+   */
+  currentValue?: {
+    [k: string]: unknown | undefined;
+  };
+  /**
+   * On `conflict`: true when the address holds a tombstone rather than a live record.
+   */
+  currentDeleted?: boolean;
+  /**
+   * On `tooLarge`: the maintainer's per-record cap in bytes.
+   */
+  limitBytes?: number;
+  /**
+   * On `tooLarge`: the size of the rejected value in bytes.
+   */
+  actualBytes?: number;
+}